> ## Documentation Index
> Fetch the complete documentation index at: https://docs.duvo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Clarity network requirements

> Hosts, ports, and protocols your network and devices must allow for Clarity voice interviews, plus a self-serve connection test.

Clarity voice interviews run in the browser and stream audio to an AI voice service in real time. On managed corporate devices and networks, a firewall, proxy, or device policy can block one of the pieces an interview needs. This page lists exactly what to allow, and how anyone on your team can check a device before involving IT.

<Tip>
  Run the **connection test** first. In Duvo, open **Clarity**, start an interview, and click **Test your connection** on the setup screen — or open `https://app.duvo.ai/teams/<your-team-id>/diagnostics/connection`. The test checks each requirement on this page in order and produces a report you can copy and send to IT. Run it on the same machine and network you will use for the interview.
</Tip>

## What an interview needs

<Steps>
  <Step title="A supported browser" icon="globe">
    A current version of Chrome, Edge, or Firefox with WebRTC enabled. A browser with WebRTC disabled by policy cannot run interviews.
  </Step>

  <Step title="Microphone access" icon="mic">
    The browser must be allowed to use a microphone at three levels:

    * **Site permission** — the browser prompts for microphone access when the interview starts. Click **Allow**. If the option is missing or greyed out, the browser is managed and the permission must be granted by policy for `https://app.duvo.ai`.
    * **Operating system privacy settings** — on Windows, **Settings > Privacy & security > Microphone**: *Microphone access* and *Let desktop apps access your microphone* must be on. On macOS, **System Settings > Privacy & Security > Microphone** must list your browser.
    * **Device management policy** — if your device is managed (Intune, Jamf, Group Policy), the administrator may need to allow microphone access for the browser and for the Duvo site.
  </Step>

  <Step title="Access to Duvo" icon="server">
    HTTPS to the Duvo app and API. This is the same access needed to use Duvo at all.
  </Step>

  <Step title="A voice connection" icon="audio-lines">
    The browser talks directly to the voice service:

    * **Live connection (WebRTC)** — HTTPS for connection setup, then encrypted audio over UDP.
    * **Secure WebSocket (WSS)** — port 443 to the same host. The connection test checks this path as well, so allow it together with the HTTPS access and the allowlist will not need a second round.
  </Step>
</Steps>

## Hosts, ports, and protocols to allow

<Warning>
  Allow by **hostname**, not by IP address. The voice service and Duvo's platform use cloud infrastructure whose IP addresses change.
</Warning>

The hosts below apply to `app.duvo.ai`. The copied connection-test report always lists the exact hosts configured for your environment — use it as the source of truth if they differ.

| Purpose                                        | Host                 | Port / protocol                                                   |
| ---------------------------------------------- | -------------------- | ----------------------------------------------------------------- |
| Duvo app                                       | `app.duvo.ai`        | TCP 443, HTTPS                                                    |
| Duvo API                                       | `platform.duvo.ai`   | TCP 443, HTTPS                                                    |
| Voice service — connection setup and WebSocket | `eu.api.openai.com`  | TCP 443, HTTPS and WSS (WebSocket)                                |
| Voice service — live audio (WebRTC)            | OpenAI media servers | Outbound UDP (SRTP/DTLS). If UDP is blocked, use the relay below. |
| Duvo voice relay (optional, enabled per team)  | `turn.prd.duvo.ai`   | TCP 443, TLS (TURN over TLS)                                      |

Notes for network administrators:

* **WebSockets must not be downgraded.** Some proxies terminate or strip the `Upgrade: websocket` handshake. The WSS upgrade to `eu.api.openai.com` must pass through untouched.
* **TLS inspection** of `eu.api.openai.com` traffic will usually break the voice connection. Exempt this host from inspection.
* **If outbound UDP is blocked**, the live connection cannot carry audio. Ask your Duvo contact to enable the **voice relay** for your team. The relay carries all interview audio over TLS on port 443 to `turn.prd.duvo.ai`, so no UDP or direct connection to the voice service's media servers is needed.
* The connection test report lists the hosts a given device actually used. If your team is on a different region or a custom configuration, trust the report over this table.

## Troubleshooting with the connection test

The test runs five checks in order and stops early only when a later check cannot run. The result tells you whether an interview can start on that device and network, and why not if it cannot.

<AccordionGroup>
  <Accordion title="Microphone failed" icon="mic-off">
    * **Access denied** — the browser or its policy blocks the microphone for the Duvo site. Click the lock or camera icon in the address bar and allow the microphone. If you cannot, the site permission must be allowed by your device policy.
    * **No microphone found** — no input device is available. Connect a headset or enable the built-in microphone in the OS sound settings.
    * **Microphone could not be opened** — a device exists but the browser cannot use it. Close other apps that may hold it (Teams, Zoom), then check the OS privacy settings above. On managed devices this is usually a policy setting.

    The test still runs the network checks with a silent stand-in stream, so the report tells IT whether the network is fine once the microphone is fixed.
  </Accordion>

  <Accordion title="Duvo connection failed" icon="server-off">
    Duvo's API could not be reached. Check the internet connection, and that `platform.duvo.ai` is allowed on TCP 443.
  </Accordion>

  <Accordion title="Live voice connection failed, WebSocket works" icon="route">
    Outbound UDP or the WebRTC setup is blocked, while `eu.api.openai.com` itself is reachable. Have IT allow outbound UDP, or ask your Duvo contact to enable the voice relay for your team. The test result states whether an interview can start on this device as configured.
  </Accordion>

  <Accordion title="Both voice connections failed" icon="shield-ban">
    A firewall or proxy blocks `eu.api.openai.com`. Confirm with a different network (a phone hotspot) and send the copied report to IT with the table above.
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Clarity" icon="mic-vocal" href="/user-guide/assignment-features/clarity">
    Capture processes with voice interviews, recordings, and documents.
  </Card>

  <Card title="Clarity to Agent" icon="bot" href="/user-guide/building-assignments/clarity-to-assignment">
    Turn a documented process into a running Agent.
  </Card>
</CardGroup>